Privacy Policy
Effective: February 2026 · THE SOVEREIGN UMBRELLA COMMAND
1 · What We Hold
Account identity (email, hashed password), your venture records, agent insights and drafts, vault documents (encrypted with Fernet symmetric encryption — we cannot read sealed content without your session), execution logs, and support conversations. Authentication uses secure httpOnly cookies; we never store session tokens in browser storage.
2 · Data Inventory — Sub-processors
| Processor | Data Shared | Purpose |
|---|---|---|
| Google (Gmail) | Email address, app password (encrypted at rest), scanned message metadata you authorize | Inbox monitoring, outbound email dispatch |
| Stripe | Tokenized payment methods, transaction records — raw card numbers never touch our servers | Command Wallet payments and charges |
| Pinecone | Vector embeddings of memory entries (no raw credentials) | Semantic search across System Memory |
| Mapbox | Coarse location context for venture mapping features, if enabled | Geographic visualization |
| Anthropic / OpenAI | Prompts and context you submit to AI features | Insights, drafts, campaigns, support answers |
| Twilio | Your phone number and alert message contents | SMS alerts |
3 · Cookies
We use one strictly-necessary cookie (uc_session, httpOnly, secure) for authentication, and a consent-preference entry in local storage. We do not run advertising or cross-site tracking cookies. The cookie banner records your choice.
4 · Your Rights — Right to be Forgotten
Download My Data: Settings → Data & Privacy exports a complete JSON archive of everything we hold about you. Delete My Account: permanently erases your account and cascades deletion across every collection — ventures, insights, drafts, tasks, vault records, payment references, memory, logs, and support chats. Deletion is immediate and irreversible.
5 · Retention & Security
Data persists until you delete it. Vault content is encrypted at rest; passwords are hashed with bcrypt; financial actions are double-gated behind explicit approval. See our Security Statement for infrastructure detail.
6 · SMS / Mobile Alerts
If you opt in to SMS alerts by entering your mobile number in Settings, we use Twilio to deliver operational alert messages (e.g., submission confirmations, bridge status changes, critical account notifications). No mobile information will be shared with third parties or affiliates for marketing or promotional purposes. Text messaging originator opt-in data and consent will not be sold, rented, or shared with any third party. Message frequency varies based on your account activity. Message and data rates may apply. You can opt out at any time by replying STOP to any message or by clearing your phone number in Settings. Reply HELP for help.
7 · Contact
Privacy requests: privacy@umbrellacommand.example. We respond within 30 days.